feat: declare the vendored modules in a manifest

[mcanouil]

The seven Lua modules taken from quarto-lua-modules now live in _extensions/gitlink/_vendor/quarto-lua-modules/, and _extensions/gitlink/_dependencies.yml records the release and the SHA-256 of each one at version 2.0.0.
Every vendored file can now be checked against the release it came from.
Six modules matched the published 1.0.0 files and were replaced by their 2.0.0 counterparts.
The seventh, string.lua, carried a local @version 1.1.0 that no release published, so it was adopted as declared and then brought to 2.0.0.

Two first-party modules needed hand editing, which is the part of this diff a reader will not expect.
_modules/bitbucket.lua and _modules/widget.lua stay first party, but each reached its dependencies through a load_sibling helper that built a path at run time from debug.getinfo and pointed into _modules/, which no longer holds those files.
Both now use the same quarto.utils.resolve_path('_vendor/quarto-lua-modules/...') call the entry point already used, and the helper, left without callers, is gone from both files.

This also names the licence and the author in docs/_scripts/sync-extension.sh, which still carried the scaffolder placeholders.

The manifest report flagged eleven further references to the moved modules, all from files that Git either does not track or ignores.
Seven come from the working copy of this extension under docs/_extensions/local/, which sync-extension.sh regenerates, and the rest from local notes and local settings that sit outside the extension.
None form part of this change, and none were edited.

Rendering docs/ after syncing the extension gives the five pages with no Lua error, the widget configuration on every page, and in-text rewriting unchanged.
A Bitbucket document turns issue #123 and pull request #456 into links, which exercises the string module through the repointed path in bitbucket.lua.